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Abstract — This paper presents a method to determine a set 
of basis polynomials from the extended Euchdean algorithm 
that allows Generalized Minimum Distance decoding of Reed- 
Solomon codes with a complexity of 0(nd). 

Index Terms — Reed-Solomon codes, GMD, Soft-Decision De- 
coding 

I. Introduction 

Decoding of Reed-Solomon (RS) codes with the help of 
the extended Euclidean algorithm (EEA) was first presented 
by Sugiyama et. al. in 1975 UJ. In 1996, Kotter introduced fast 
Generalized Minimum Distance (GMD) decoding of RS codes 
121. A first approach to combine GMD decoding and decoding 
with the EEA was presented in fS). However, the approach 
presented there does not allow decoding with a complexity 
less than 0{(f). 

GMD decoding consists mainly of two steps, the first is the 
calculation of a list of possible solution, and the second step 
is to choose one of the solutions from a list. In this paper, we 
investigate only the task of finding the list of solutions. The 
approach presented accomplishes this with complexity 0{cP). 

The paper is organized as follows: In the next section, we 
give the definition of RS codes and the polynomials used 
in decoding with the EEA. We also shortly recall the idea 
of GMD decoding. In Section HUl we derive a new stopping 
criterion for the EEA and show how this can be used in the 
definition of the new basis polynomials. After the definition, 
we derive the amount of additional information necessary 
for decoding. We shortly recall the FIA in Section IIVI and 
show the modification that reduces the complexity. Section [V] 
concludes the paper 

II. Notations and Definitions 
A. RS Codes and Key Equation 

In this paper, an TZS{n, k,d = n — k + 1) code over GF{q) 
with rate R = ^ \s, defined in the spectral domain such that 

This work was supported by the German Research Council "Deutsche 
Forschungsgemeinschaft" (DFG) under Grant No. Bo867/22. 



the spectrum of all codewords is zero at the first n — k = d—1 
coefficients, hence 



Cix) = Cd-ix"-' + ■■■ + C„^ia;" 



(1) 



the information symbols Ci G GF{q), i ~ d — 1, . . . ,n — 1. 
The codeword c{x) = cq + cix + ■ ■ ■ + c„_ia;"^^ is calculated 
by the inverse discrete Fourier transform (IDFT): 



C{a-'), i = 0,...,n-l, 



(2) 



and conversely C{x) can be recovered by applying the discrete 
Fourier transform (DFT) to c{x): 

Cj=c(a^), j = 0,...,n-l. (3) 

Thereby, let a G GF{q) denote an element of order n. 
Throughout this paper, capital letters denote polynomials in 
the spectral domain, and small letters their correspondences 
in the time domain. 

The transmitted codeword is corrupted by an additive error 
e{x) of weight t, and the received word is r{x) = c{x) + e{x) . 
For decoding, calculate the syndrome S{x): 



Six) = R{x) mod x'^-^ = E{x) mod 



(4) 



This syndrome is used in the key equation for decoding RS 
codes: 

- n[x) = Aix) ■ S{x) mod x'^-\ (5) 

with the error locator polynomial A(a;) and the error evaluator 
polynomial n{x). These two polynomials satisfy the important 
degree relation: 



deg fl{x) < deg A{x) = t. 



(6) 



B. Decoding with the EEA 

Sugiyama et. al. HI showed that Q can be solved using the 
EEA. The EEA uses the input polynomials A{x) = r^'^\x) 



and B{x) 



r.(-l) 



{x) to recursively calculate a series of quo- 



tient polynomials q^^^ [x) and remainders r^-'^ [x) that fulfill: 



(7) 



with deg 7''-'+^)(x) < deg 7-(-')(x). From the quotient poly- 
nomials, a series of auxiliary polynomials u^^^ {x) is obtained 
recursively, namely 

u^^-^\x) - q<-J+^\x) ■ u^^^x), (8) 

where u^~^'>{x) = and u^^'^lx) = 1. The degrees of these 
polynomials are given by 

j 

deg u'-^^ (x) = deg q'-'^ (x) . (9) 

Further, these polynomials fulfill the relation 

u^'^x) ■ A{x) = A^^x) mod B{x), (10) 

which has a form similar to the key equation (|5]l. This implies 
that the EEA can be used for solving (|5]l. Hence by setting 

A{x) = S{x) and B{x) — x'^^^, in some steps of the EEA, 
whenever 

deg u^^'^{x) > deg r^^\x). (11) 

we obtain polynomials fulfilling both (|5]i and If the 
number of errors t, i.e. the number of nonzero coefficients 
in e{x), is limited by i < [^^J, then it is known [IJ that 
t = deg w(^'(a;), A{x) u'^^^x) and i}{x) = -r'-j^x) if j is 
the smallest index for which ( fTTI ) is fulfilled. 
Another property we will use is that HI 

deg (x) + deg r^^' (x) < d - 2. (12) 

Because our analysis relies strongly on the degrees of the 
polynomials, we introduce the abbreviation S for the degree 
of a polynomial, i.e. SA^^f = deg r'^' (x), and equivalently for 
all other polynomials. 

C. GMD Decoding 

GMD decoding, introduced by Forney H, is a method for 
soft-decision decoding by multi-trial decoding with a simple 
decoder. To accomplish this, a GMD decoder performs m 
decoding trials. In each trial j ~ l,...,m, the Tj least 
reliable symbols are erased. For GMD decoding, we take the 
polynomial A(a;) to be a joint error and erasure locator, so if 
the symbol at position i is erased, we know that A(q;^') = 0. 
This means, that if we obtain A{x) as a linear combination of 
polynomials ID 

A(x) = ^AAW(x), (13) 

then each erasure gives us one equation for the determination 
of the coefficients (3i. If we find a proper locator polynomial, 
i.e. a polynomial of degree t with exactly t roots in GF(q), 
we store this polynomial in a list. After all trials have been 
performed, the GMD decoder selects one error locator which 
minimizes the error weight in a given metric. 

For the description of the algorithm, it is not necessary to 
know the origin or calculation of the reliability information. 
Therefore, we assume that our decoder is provided with a list 
of positions, sorted by reliability. The positions are erased in 
order of reliability, with the least reliable position being erased 



first. Further, we do not address the problem of choosing a 
single solution in this paper We only state that it is possible 
to solve this problem with quadratic complexity, too, in a way 
similar to the one presented in [2]. 

III. A Closer Look at Decoding With the Extended 
Euclidean Algorithm 

A. The Polynomials Calculated in the EEA 

As mentioned, if t < I ^^^J , the error locator polynomial 
equals the polynomial u'^^ (x) of least index j for which (fTTT i 
is fulfilled. We will now verify this limitation of the decoding 
radius in an unusual manner, thereby introducing a value s'-'-' 
we will need later. 

Consider the syndrome polynomials S{x). It was defined 
to be the known part of the spectrum, where the spectrum 
is assumed to be cyclically consecutive. This means that the 
(virtual) coefficient S-i is unknown. E.g. if the codeword 
is defined as in ([T]i, then S^i = En-i which is unknown 
because in general C„_i 0. Because S{x) = r^°^(x), we 
set s(°) = -1. Since A^\x) = r^'^^x) - q^^\x) ■ A°\x), 
we conclude that the unknown coefficient S^i now affects the 
virtual coefficient r?^^ and the coefficients Tq^', . . . , fi^j^^^d) 
in r'-^'>{x) and these, too, become unknown. Therefore, we set 
s^^-* = (5(7*^^^ — 1, to indicate the largest coefficient of A^^{x) 
that is unknown. In the same way, we find for all iterations: 

j 

sU) ^ gU-l) + SqU) = Sqi^) + s(0) ^ §^U) _ I (14) 

Of course we cannot use any of the unknown coefficients r^''\ 
i < s^-'-', in the determination of the next quotient polynomial 
g(-'+^)(a;). If ^ is fulfilled we see that dV-?) < s^^^ and we 
cannot proceed any further, since we do not know any element 
of the remainder A^^x). The following Lemma gives a more 
general statement. 

Lemma 1 In any step of the EEA, at most c^^"*"^-* = (5r^^^ — 
s'-'^ coefficients of q^^^^\x) can be calculated. 

Due to the limited space, no proof is given here. 

Next, we show that the number of coefficients that can be 
calculated limits the decoding radius to [^^J. Namely, the 
decoder will only be able to correctly determine the auxiliary 
polynomial u'^^^{x) if 6u'^^^ < [^^^J- In order to show this, 
recall that a formula similar to (T4\ exists for Sr^^'': From (|7|, 
we see that 

dq'^^+^^ ^ Sr'^^-^^ - Sr^^\ (15) 
which we can rewrite to 

5r^-^^ =d-l-Su^"^^'>. (16) 

The following two lemmas show that the value cP~^^'> can 
also be used as a stopping criterion for the EEA. First, we show 



that if the classical decoding radius is exceeded, i.e. 5u^^^ > 
[^^J, then we can never calculate a coefficient of the next 
quotient polynomial because c'^-'+^) < 0. We do so by showing 
the complementary statement. Afterwards, we show that the 
next auxiliary polynomial can only be entirely calculated if 
with this, too, [^^^J is not exceeded. 

Lemma 2 If c^^+i) > q then Su^^^ < [^J. 
Proof: We use (fT6l ) and ( fT4l i to rewrite: 



= d-l + l-2^5g'')-(5g' 

i=l 

Because > 1, we obtain 

< c(^+i) <d-l-26u^^\ 
which is equivalent to 



(j+i) 



(18) 



d-1 



(19) 



(20) 



If d is odd, [%^J = ^j^. If d is even, then is not an 
integer, and cannot exceed [^^J. ■ 
Note, that if Ju'-'^ — [^^J , it is not possible to calculate 
the next quotient polynomial: If d is odd, SA^^^ < due 
to (fT2] i. which directly gives us c^-'^^^ < 0. If d is even, 
then SA^^ < and c^^+^'' < 1. Since we always need to 
calculate (Jg^^'*'^-' + 1 > 2 coefficients in the next quotient 
polynomial, we will not be able to calculate (x) in this 

case. 

The next lemma shows, that we are only able to determine 
the complete quotient polynomial q^^'^^^ (x) in the next itera- 
tion if 6u^^^^^ < [^^J, i.e. we do not exceed the decoding 
radius in the next iteration. 

Lemma 3 Let A^^^'i > 0. The following relations hold: 

Ifc(^+-L) > fr^J-i) - 5r(j') + 1, then Su^^+'^^ < [^J. 

//c(j+i) < <5r(J-i) - 5r(j') + 1, then Su^^+^') > [^J. 
Proof: We rewrite, using ( fTSb : 

= - (22) 

Further, we can rewrite ( fTTT i to c'^+^-' = d — 5u^^^ — Su'^^^^y 
Combining this with (|22] |. we find that for the first case given 
in Lemma 12 



(23) 



Because [^^J = for odd values of d and is not 



an 



integer if d is even, it is possible to state 

d-1 



(24) 



The second case is similar: 

d - Su^^'> - (5u(^+i' < du^^+^'> - Su^^'> + 1 ^ 

d-1 



(25) 



fi. From the EEA to the Linear System of Equations 

Now we will derive the basis polynomials used for the 
FIA. Given that the syndrome polynomial is of sufficient 
degree, each error locator polynomial can be obtained as the 
normalized auxiliary polynomial u^'^ (x) in some step i of the 
EEA. These auxiliary polynomials are calculated recursively, 
see ([8]l. We apply this recursion and find 

(x) = _ qit) (a;) (26) 

= -q'^'Hx)u'^'-^Hx) + 

+ {q^'\x)q^'-^\x) + l)u^'-^\x) (27) 

= iq'''\x)q^'-^^x) + l)u'-'-^\x) - 



Hence, M^*^(a;) can always be obtained from any two poly- 
nomials u'-^^'^°'> (x) and calculated during ear- 
lier steps of the EEA. Of course, the higher the degree of 
(x) and 7i('~*"~^' (.t), the lower the degree of the 
polynomials that still have to be determined. 

The proposed method therefore calculates two polynomials 
A(^^(a;) and A^^)(a;) from the EEA which are then multiplied 
by polynomials a^*)(a;) and a'^'^^x) respectively to obtain 
i.e. 



u^'\x) = a('''(x)A(i)(x) +a«(x)A(2)(x). 



(29) 



If i < [^^J, we can calculate a'^*'(x) and a^*)(x) from 
the syndrome. But if t > [^^J, it is necessary to use e.g. 
reliability information to fully determine a(*''(a;) and a'^^'>{x). 
The intuitive solution is to choose A'^^(a;) and A(^^(a:) as 
two polynomials obtained from the EEA, while a'^*^(a;) and 
a^^\x) are obtained by using a GMD decoding method. We 
first set 



A^^\x) 



Mb) 



[x) and 



(30) 

A(2)(a;) = (31) 

where is is such that < [^J and > [^^J . 

These are the polynomials of highest degree that are obtained 
from the EEA, leaving the determination of polynomials 
a*^*^ (x) and 5^*^ (x) of smallest degree. When performing the 
recursive expansion as in (l26b to ( |28] | until i — io = is, then 
we find that a^'^ {x) consists of the sum of 



n ^ 



(x) 



(32) 



and some terms where not all of the factors are present. The 
same holds for a'^*'(a;) and nj=jj3+2 '^'^"'H^)- Therefore, we 



find that 



(5a(') = deg JJ l^^^i^) 



(33) 



5a^'^ = deg ]J q^'\x), (34) 

j=ii3 + l 

with the empty product being defined as 1. Special care needs 
to be taken with Sq'^^'^^'^^ in case we stopped the EEA because 
^j.(ib ) _ g(iB ) ^ Q- 'pjjjg condition imphes, that the coefficient 
r^)f\ = 0. However, the definition of s^*^) tells us that this 
coefficient is unknown, hence we cannot be sure of 6A'^\ It 
is therefore reasonable to set 



(35) 



On the other hand, we can do better if we stopped the EEA 
because < SA^^'> - s(*«) < dA"'-'^'> - SA'^\ The first 
inequality tells us that we still can correctly determine some 
of the coefficients of (/'^'^^^^(x), but the second inequality 
shows that we cannot determine the whole quotient polyno- 
mial. Denote the part of (/('^^^^(x) with known coefficients 



(ifl+i) 



(x) then is the part with unknown 



as q 

coefficients and q'^'^+^^x) = q^'^+^'^{x) + q'^'^+^^x). In this 
case, we define 

A^^\x) ^ u^'^'^x) and (36) 

A(2)(x) = u^'^-^\x)+q^'^^x) ■u^'^'^ix), (37) 

To see that this definition is reasonable, we write 

+ q^'^+^\x)u^'''\x), (38) 

i.e. 5a^'^+^\x) = 1 and 5a^'^+'^\x) = 5q'^^^+^\x). Com- 
pared to ( [34I 1. we see that with this definition the number of 
unknown coefficients that need to be determined is smaller 
than before. For the next step, we find that 



u 



^^^\x) ■ {\ + q^'''+^\x)q(''' + ^\x) 



+ A(2)(x) (39) 

which is equivalent to (l33b and ( l34l i for the second step, only 
now being replaced by g'^*^+^^(a;). 

C. Necessary Number of Erasures 

With the basis polynomials used in pi), we need 21^ erasures 
if i = L^T^J ^0 errors shall be corrected. We will now 
show that we need the same number of erasures for the 
proposed method. First consider the situation as given in ( [30l l 
and (EB, i.e. (5r(''«) - s'^^) < 0. The polynomial u^'^'^+^^x) 
is the polynomial of least degree for that we need to apply 
GMD decoding. In order to determine this polynomial, we 
need to find the polynomials a^^^^^\x) and cS^'^^^\x). Let 
Su'^^B+i) ^ ^^^^ According to (El: 

^j^l^B-i) ^ (40) 



Combining the first and last row, one finds 



(41) 



For odd d we find that (5a(*«+^) = 2ti-l, while (5a(*«+i) = 0, 
so the total number of unknown coefficients is 



5a('^+^) + 1 + (5a(*«) + 1 = 2fi + 1. 



(42) 



If d is even, then (5a''^+^^ = 2ti — 2 and the total number of 
unknown coefficients is 2ti. On the other hand, if the EEA was 
stopped because < Jr^'^' - s^''^^ < (5r(*«~^) - 5r'^''^\x), 
we get 



= ■■■ = -d+l + 25w(*«+i). 



,(^b) 



(43) 



From this we find that (5a('«+^) (cc) = 2ti - 1 if d is odd, 
and 5a^^'^^'^\x) = 2ti — 2 if d is even, so we get the same 
total number of unknowns as before. Since one coefficient 
can always be chosen in order to normalize the error locator 
polynomial, we find that 2ti erasures are enough to find 
For the further polynomials with (Jit^*' = [^^J +io, 
to > ti, we note that 



(5aW=deg J| q^^\x) ^ 5d^'^ 

J=iB+2 



Thus, 



Su'^'^ = +des 



J=tB+2 



(44) 



(45) 



and so we must have deg iY[]=ig+2 1 y^)) ~ to ^ ti- This 
directly yields the number of unknown coefficients 



(5a(^+i) + 1 + Sa^''> + 1 = 2in + 1, 



(46) 



i.e. we need 2to erasures, because again one coefficient is 
chosen due to normaUzation. 

IV. The Fundamental Iterative Algorithm 

The original version of the FIA as introduced by Feng 
and Tzeng in f5\ gives the smallest set of linearly dependent 
leading columns of a matrix A, together with the connection 
vector, indicating the vanishing linear combination. However, 
we again use the same modification as in |[3l, where we obtain 
all the solutions to all 2r x (2t + 1) submatrices that are 
situated in the upper left corner of A. The FIA solves homo- 
geneous, linear systems of equations, so we reformulate our 
problem. If Ju^*^^^-* (x) = [^^J +1- then instead of looking 
for two polynomials with (5a(*^+^' = and (5a(*^+^' = 1, we 
search for a linear combination of the polynomials A^^)(a;), 
X ■ A(i)(x) and A(2)(a;); then additionally • A(i)(a;) and 
X ■ A(2)(.t) when Ja^^^+i) = 1 and (Ja^'^+i) = 2, and so on. 
It will be seen later that this choice allows us to decrease the 
complexity of the FIA to 0{d'^). 

We see in ( l33T l and (|34] |. that sometimes Ja^^' and 6d^^^ 
increase by more than one for the next step. We ignore this 



during the execution of the FIA. In such a case, the interme- 
diate result should not give a valid error locator polynomial. 
But since the gap has the same size in both the sequence of 
degrees of a^^'>{x) and a^^'>{x), the next allowed solution will 
be obtained during one of the next steps of the FIA. 

For a detailed description of the FIA, the reader is referred 
to m. Here, we only note that the FIA starts the examination 
of each column with a connection vector a, also called the 
starting vector The FIA then calculates in each row a so-called 
discrepancy. If the discrepancy is zero, the connection vector 
is a valid solution for the current sub-system of equations, and 
the algorithm proceeds with the next row. If the discrepancy 
is non-zero, the connection vector is updated if possible, 
otherwise the vector and discrepancy are stored. The basic 
FIA has complexity 0{d^). It is known, cf. eg. i2j, that this 
complexity can be reduced if we can find a starting vector 
that allows us to save operations. We now show how this is 
possible with our basis polynomials. 

The following matrix describes the system of equations that 
we want to solve with the FIA: 



A = 



/A(i)(ai) 
AW(a2) 
A(i)(a3) 
A(i)(a4) 

V 



aiA(i)(ai) 
Q;2A(i)(a2) 
a3A(i)(a3) 
a4A(i)(a4) 



A(2)(ai) 

A(2)(a2) 
A(2)(a3) 
A(2)(a4) 



.?A(i)(ai) ••.\ 



0:2) 



«lA(i)(a4) 



/ 

(47) 

Assume that the vector (oi, 02, 03, ... , 02^+1) solves the first 
j equations of the 2i x {2i + l) submatrix, i.e. the polynomial 



Ai(x) = {ai + + a4x'^ 
+ (03 + ar,x + ■ ■ ■ 



h a2,x') ■ utsix) 

a2»+ia;'"^) ■wtB-i(a;)(48) 



has zeros for ai,...,aj. Then the vector 
(0, ai, 0, a2, 03, . . . , a2i+i) of length 2i + 3 fulfills the 
first j equations of the {2i + 2) x (2i + 3) subsystem of 
equations: Namely, this vector yields the polynomial 

(aix + a2X^ H h a2ix'^^) ■ Utg{x) 

+ {a^x H h a2t+ix') ■ uts-i{x) = x ■ Ai(x). (49) 

This polynomial has the same zeros as Ai(a;) plus an addi- 
tional zero at x — 0. Hence, by choosing this starting vector, 
it suffices to start the examination of the (2i + 3)th column in 
row j + 1. Due to the fact that in column i we always take 
the connection vector stored in column i — 2, it is necessary 
to store them separately for even and odd columns. Therefore 
we have to traverse the matrix from top to bottom twice, yet 
compared to the basic FIA where the matrix has to be traversed 
0{d) times, we are able to reduce the complexity to 0{(P). 

If Jqf'f+i) > 1, then (5a(*) - Sa^"^ = 2ti - I and we 
need a slight modification to the algorithm described before. 
In order to keep the pattern of using the padded connection 
vector stored in column i as starting vector in column i + 2 
in as many columns as possible, we write the evaluations of 
A(i)(x),xA(i)(a;), . . . , x2*i-iA(i)(a;) in the first 2ti columns 
and A*^^)(x) in the {2ti + l)th column. As starting vector for 



columns i = 2, . . . , 2ti we choose the connection vector stored 
in column i — 1, padded with a zero in the first position. If the 
vector was stored for row j, we can start the examination of 
column i in row j. In column 2ti + 1, we start again in row 1, 
and for any future column i use the connection vector stored 
in column i — 2, padded with zeros in positions 1 and 2ti + 1. 
Figure [T] shows the rows and columns examined by the FIA 
for ti = 2. The code used was an 72.5(16, 6, 11) over GF{17). 
Here, all the points (x, y) marked by a dot denote the point 
where a connection vector is stored, while the points marked 
with diamonds show at which point a connection vector was 
stored as a possible solution, i.e. in this case we obtain three 
candidate error locators. It can be seen, that the algorithm 
works very regular in columns 1 through 6. In column 7 and 
row 7, the discrepancy is zero, so that a vector is stored only 
in row 8. This causes the third solution, stored in column 9, 
not to include a term aa;^ A'^^ (x). Note, that this general case 
is consistent with the previous description for = 1. 

Columns and rows examinded by the FIA 



■fi 3 

8 




\ \ \ \ \ 

3 4 5 6 7 
Column of matrix A 



Fig. 1. Rows and columns examined by tlie FIA 

V. Conclusion 

We presented a method to compute basic polynomials from 
the EEA that allow fast GMD decoding, because the list 
of possible solutions can be found with complexity 0{<f'). 
Compared to IS), we gain one order of complexity, and achieve 
the same complexity as An approach to merge GMD 
decoding into the EEA, thereby superseding the use of the 
FIA, has been submitted to ITW 2010. 
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